How can I find a web application's document root using a path traversal vulnerability?

Question

I am performing a penetration testing on an application hosted on an Ubuntu environment.

So using a path traversal vulnerability, I can download any file.

The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.

What I have tried:

Search for logs that can lead me to the path. nginx or apache2 is not there.
Search for nginx, apache2 or other configuration files
Search for common directories of web roots (https://serverfault.com/questions/144598/where-should-the-web-server-root-directory-go-in-linux)
Bash histories of all users

What else should I try?

What about the /opt location?
– Jeroen
Commented Mar 15, 2019 at 23:58 — Jeroen, Commented Mar 15, 2019 at 23:58
@Jeroen-ITNerdbox no luck :)
– Lucian Nitescu
Commented Mar 16, 2019 at 0:09 — Lucian Nitescu, Commented Mar 16, 2019 at 0:09

Daisetsu · Accepted Answer · 2019-03-16 00:32:31Z

7

Use the traversal vulnerability to read

/proc/self/environ

This prints out environment variables among other thread information.

Look for a environment variable called DOCUMENT_ROOT

answered Mar 16, 2019 at 0:32

Daisetsu

5,1601 gold badge16 silver badges25 bronze badges

Add a comment |

1 Answer 1